Add Auth support to Helm chart

- Move grpc routes into template function Based on - 840f250 Add Auth Ingress endpoints (#982) - 1ede375 Authentication Config Examples (#970) - 77941a3 explicitly grant flyteworkflow finalizer permissions to flytepropeller (#930) Signed-off-by: Sören Brunk <[email protected]> Signed-off-by: Haytham Abuelfutuh <[email protected]>
flyteorg · May 28, 2021 · 889cd66 · 889cd66
1 parent e89b23b
commit 889cd66
Show file tree

Hide file tree

Showing 6 changed files with 200 additions and 126 deletions.
diff --git a/helm/templates/admin/deployment.yaml b/helm/templates/admin/deployment.yaml
@@ -18,57 +18,73 @@ spec:
       labels: {{ include "flyteadmin.labels" . | nindent 8 }}
     spec:
       initContainers:
-      {{- if .Values.postgres.enabled }}
-      - name: check-db-ready
-        image: postgres:10.16-alpine
-        command:
-        - sh
-        - -c
-        - until pg_isready -h postgres -p 5432; do echo waiting for database; sleep 2; done;
-      {{- end }}
-      - command:
-        - flyteadmin
-        - --config
-        - {{ .Values.flyteadmin.configPath }}
-        - migrate
-        - run
-        image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
-        imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
-        name: run-migrations
-        volumeMounts: {{- include "databaseSecret.volumeMount" . | nindent 8 }}
-        - mountPath: /etc/flyte/config
-          name: config-volume
-      - command:
-        - flyteadmin
-        - --config
-        - {{ .Values.flyteadmin.configPath }}
-        - migrate
-        - seed-projects
-        - flytesnacks
-        - flytetester
-        - flyteexamples
-        image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
-        imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
-        name: seed-projects
-        volumeMounts: {{- include "databaseSecret.volumeMount" . | nindent 8 }}
-        - mountPath: /etc/flyte/config
-          name: config-volume
-      {{- if .Values.cluster_resource_manager.enabled }}
-      - command:
-        - flyteadmin
-        - --config
-        - {{ .Values.flyteadmin.configPath }}
-        - clusterresource
-        - sync
-        image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
-        imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
-        name: sync-cluster-resources
-        volumeMounts: {{- include "databaseSecret.volumeMount" . | nindent 8 }}
-        - mountPath: /etc/flyte/clusterresource/templates
-          name: resource-templates
-        - mountPath: /etc/flyte/config
-          name: config-volume
-      {{- end }}
+        {{- if .Values.postgres.enabled }}
+        - name: check-db-ready
+          image: postgres:10.16-alpine
+          command:
+          - sh
+          - -c
+          - until pg_isready -h postgres -p 5432; do echo waiting for database; sleep 2; done;
+        {{- end }}
+        - command:
+          - flyteadmin
+          - --config
+          - {{ .Values.flyteadmin.configPath }}
+          - migrate
+          - run
+          image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
+          imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
+          name: run-migrations
+          volumeMounts: {{- include "databaseSecret.volumeMount" . | nindent 8 }}
+          - mountPath: /etc/flyte/config
+            name: config-volume
+        - command:
+          - flyteadmin
+          - --config
+          - {{ .Values.flyteadmin.configPath }}
+          - migrate
+          - seed-projects
+          - flytesnacks
+          - flytetester
+          - flyteexamples
+          image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
+          imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
+          name: seed-projects
+          volumeMounts: {{- include "databaseSecret.volumeMount" . | nindent 8 }}
+          - mountPath: /etc/flyte/config
+            name: config-volume
+        {{- if .Values.cluster_resource_manager.enabled }}
+        - command:
+          - flyteadmin
+          - --config
+          - {{ .Values.flyteadmin.configPath }}
+          - clusterresource
+          - sync
+          image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
+          imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
+          name: sync-cluster-resources
+          volumeMounts: {{- include "databaseSecret.volumeMount" . | nindent 8 }}
+          - mountPath: /etc/flyte/clusterresource/templates
+            name: resource-templates
+          - mountPath: /etc/flyte/config
+            name: config-volume
+        {{- end }}
+        - name: generate-secrets
+          image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
+          imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
+          command: ["/bin/sh", "-c"]
+          args:
+            [
+                "flyteadmin --config={{ .Values.flyteadmin.configPath }} secrets init --localPath /etc/secrets/auth && flyteadmin --config=/etc/flyte/config/*.yaml secrets create --fromPath /etc/secrets/auth",
+            ]
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/flyte/config
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
       containers:
       - command:
         - flyteadmin
@@ -90,6 +106,8 @@ spec:
           name: shared-data
         - mountPath: /etc/flyte/config
           name: config-volume
+        - name: auth
+          mountPath: /etc/secrets/
       - command:
         - sh
         - -c
@@ -112,16 +130,19 @@ spec:
             memory: 200Mi
       serviceAccountName: {{ template "flyteadmin.name" . }}
       volumes: {{- include "databaseSecret.volume" . | nindent 6 }}
-      - emptyDir: {}
-        name: shared-data
-      - configMap:
-          name: flyte-admin-config
-        name: config-volume
-      {{- if .Values.cluster_resource_manager.enabled }}
-      - configMap:
-          name: clusterresource-template
-        name: resource-templates
-      {{- end }}
+        - emptyDir: {}
+          name: shared-data
+        - configMap:
+            name: flyte-admin-config
+          name: config-volume
+        {{- if .Values.cluster_resource_manager.enabled }}
+        - configMap:
+            name: clusterresource-template
+          name: resource-templates
+        {{- end }}
+        - name: auth
+          secret:
+            secretName: flyte-admin-auth
       {{- with .Values.flyteadmin.nodeSelector }}
       nodeSelector: {{ toYaml . | nindent 8 }}
       {{- end }}

diff --git a/helm/templates/common/ingress.yaml b/helm/templates/common/ingress.yaml
@@ -1,3 +1,36 @@
+{{- define "grpcRoutes" -}}
+# NOTE: Port 81 in flyteadmin is the GRPC server port for FlyteAdmin.
+- path: /flyteidl.service.AdminService
+  pathType: ImplementationSpecific
+  backend:
+    serviceName: flyteadmin
+    servicePort: 81
+- path: /flyteidl.service.AdminService/*
+  pathType: ImplementationSpecific
+  backend:
+    serviceName: flyteadmin
+    servicePort: 81
+- path: /flyteidl.service.AuthMetadataService
+  pathType: ImplementationSpecific
+  backend:
+    serviceName: flyteadmin
+    servicePort: 81
+- path: /flyteidl.service.AuthMetadataService/*
+  pathType: ImplementationSpecific
+  backend:
+    serviceName: flyteadmin
+    servicePort: 81
+- path: /flyteidl.service.IdentityService
+  pathType: ImplementationSpecific
+  backend:
+    serviceName: flyteadmin
+    servicePort: 81
+- path: /flyteidl.service.IdentityService/*
+  pathType: ImplementationSpecific
+  backend:
+    serviceName: flyteadmin
+    servicePort: 81
+{{- end }}
 {{- if .Values.common.ingress.enabled }}
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
@@ -69,6 +102,11 @@ spec:
             backend:
               serviceName: flyteadmin
               servicePort: 80
+          - path: /.well-known
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: flyteadmin
+              servicePort: 80
           - path: /.well-known/*
             pathType: ImplementationSpecific
             backend:
@@ -120,37 +158,7 @@ spec:
               serviceName: flyteadmin
               servicePort: 80
           {{- if not .Values.common.ingress.separateGrpcIngress }}
-          # NOTE: Port 81 in flyteadmin is the GRPC server port for FlyteAdmin.
-          - path: /flyteidl.service.AdminService
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.AdminService/*
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.AuthMetadataService
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.AuthMetadataService/*
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.IdentityService
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.IdentityService/*
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
+          {{- include "grpcRoutes" . | nindent 10 -}}
           {{- end }}
       {{- with .Values.common.ingress.host }}
       host: {{ . }}
@@ -190,37 +198,7 @@ spec:
             path: /*
             pathType: ImplementationSpecific
           {{- end }}
-          # NOTE: Port 81 in flyteadmin is the GRPC server port for FlyteAdmin.
-          - path: /flyteidl.service.AdminService
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.AdminService/*
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.AuthMetadataService
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.AuthMetadataService/*
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.IdentityService
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
-          - path: /flyteidl.service.IdentityService/*
-            pathType: ImplementationSpecific
-            backend:
-              serviceName: flyteadmin
-              servicePort: 81
+          {{- include "grpcRoutes" . | nindent 10 -}}
       {{- with .Values.common.ingress.host }}
       host: {{ . }}
       {{- end }}

diff --git a/helm/templates/propeller/deployment.yaml b/helm/templates/propeller/deployment.yaml
@@ -37,13 +37,18 @@ spec:
         - containerPort: 10254
         resources: {{ toYaml .Values.flytepropeller.resources | nindent 10 }}
         volumeMounts:
-        - mountPath: /etc/flyte/config
-          name: config-volume
+          - name: config-volume
+            mountPath: /etc/flyte/config
+          - name: auth
+            mountPath: /etc/secrets/
       serviceAccountName: {{ template "flytepropeller.name" . }}
       volumes:
       - configMap:
           name: flyte-propeller-config
         name: config-volume
+      - name: auth
+        secret:
+          secretName: flyte-propeller-auth
       {{- with .Values.flytepropeller.nodeSelector }}
       nodeSelector: {{ toYaml . | nindent 8 }}
       {{- end }}

diff --git a/helm/templates/propeller/rbac.yaml b/helm/templates/propeller/rbac.yaml
@@ -21,6 +21,7 @@ metadata:
   name: {{ template "flytepropeller.name" . }}
   labels: {{ include "flytepropeller.labels" . | nindent 4 }}
 rules:
+# Allow RO access to PODS
 - apiGroups:
   - ""
   resources:
@@ -29,6 +30,7 @@ rules:
   - get
   - list
   - watch
+# Allow Event recording access
 - apiGroups:
   - ""
   resources:
@@ -38,6 +40,7 @@ rules:
   - update
   - delete
   - patch
+# Allow Access All plugin objects
 - apiGroups:
   - '*'
   resources:
@@ -50,6 +53,7 @@ rules:
   - update
   - delete
   - patch
+# Allow Access to CRD
 - apiGroups:
   - apiextensions.k8s.io
   resources:
@@ -61,10 +65,12 @@ rules:
   - create
   - delete
   - update
+# Allow Access to all resources under flyte.lyft.com
 - apiGroups:
   - flyte.lyft.com
   resources:
   - flyteworkflows
+  - flyteworkflows/finalizers
   verbs:
   - get
   - list

diff --git a/helm/values-gcp.yaml b/helm/values-gcp.yaml
@@ -6,11 +6,31 @@ common:
   databaseSecret: {}
   ingress:
 
+# -----------------------------------------------------
+# Core dependencies that should be configured for Flyte to work on any platform
+# Specifically 2 - Storage (s3, gcs etc), Production RDBMS - Aurora, CloudSQL etc
+# ------------------------------------------------------
+#
+# STORAGE SETTINGS
+#
+
+storage:
+  # -- Sets the storage type. Supported values are sandbox, s3, gcs and custom.
+  type: gcs
+  # -- bucketName defines the storage bucket flyte will use. Required for all types except for sandbox.
+  bucketName: <BUCKET_NAME>
+  gcs:
+    projectId: <GOOGLE_PROJECT_ID>
+
 #
 # CONFIGMAPS
 #
 
 configmap:
+  remoteData:
+    remoteData:
+      scheme: "gcp"
+
   tasks:
     max-plugin-phase-versions: 1000000
     task-plugins: